Using Memcached is incompatible with OIDCSessionInactivityTimeout higher than 30 days

[takesson]

Sessions with expiry higher than 30 days are immediately lost when storing in memcached. Typically results in an infinite auth loop.

In order to store data with ttl higher than 30 days in memcached the ttl / expiry must be expressed in epoch instead of "seconds to live". I suggest always sending epoch expiry to memcached, should work both above and below the 30 day threshold.

https://github.com/zmartzone/mod_auth_openidc/blob/9a04dba9fab14270548e2c458d4f9a9ea3063515/src/cache/memcache.c#L332

https://github.com/memcached/memcached/wiki/Commands

"An expiration time, in seconds. '0' means never expire. Can be up to 30 days. After 30 days, is treated as a unix timestamp of an exact date."

[zandbelt]

good catch, thanks for reporting, it seems that changing that line to

apr_uint32_t timeout = apr_time_sec(expiry); 

is all that is needed, perhaps you can confirm?

[takesson]

That looks good to me.

I currently don't build mod_auth_openidc from source so I can't confirm quickly. Can you send me a build for Ubuntu 22.04? I can drop that in and test.

Thanks.

[zandbelt]

that works for me (tested for short timeouts), please confirm using https://www.mod-auth-openidc.org/downloads/libapache2-mod-auth-openidc_2.4.11.4rc6-1~jammy+1_amd64.deb

[takesson]

Thanks for the build. I dropped it into my test framework.

I can now see session entries in memcached when using maximum timeout. Previously the session vanished.

add s:LSBrWzvEvAlJ5Xl1pRkS92ThNGIMJ5yCMYuAy4Et_tw 0 1697315207 4268
...

Also noted compared to 2.4.11.2:

• The cached session is slightly larger with the same token content, was 4111 bytes before.
• There is a new cache entry type 'd' which also has the long ttl. What is stored in 'd'?

add d:GvxFFnC89SSPuWPf1dJK8xB1VEhRbCdgnH9Hrk_1Npk 0 1697315207 253
...

In summary, the fix looks good!

Also, please verify the discussion reference in the release notes, should be #936.

[zandbelt]

the larger session size and the new cache type are due to keeping track of more session information for logout purposes, done by keeping track of an OP provided session identifier/handle ("sid"), that has to be mapped to a mod_auth_openidc session identifier